Update displayName / description / IGW / DNS flags / labels.
curl --request PATCH \ --url 'https://stratum.example.com/v1/projects/example/network/vpcs/example?force=false' \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data '{ "displayName": "example", "description": "example", "internetGateway": true, "dnsHostnames": true, "dnsResolution": true, "tags": { "additionalProperty": "example" } }'CIDR, region, and name are immutable.
Turning the Internet gateway off (internetGateway: false) cuts the
egress of every instance in the VPC. On a platform-owned VPC
(ownedBy.kind: platform) it is refused like a delete, with 403
PLATFORM_MANAGED, unless force=true and the caller holds
platform:ManageInternal.
Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”Query Parameters
Section titled “Query Parameters”Override the platform fence. Deleting a platform-owned row (ownedBy.kind: platform), or an update that removes a working part of one (turning off its VPC’s Internet gateway), is refused with 403 PLATFORM_MANAGED unless this is true and the caller holds platform:ManageInternal. Every override is audited Critical as platform.internal_resource.override, and the platform’s seeder re-creates the resource on its next pass.
Request Bodyrequired
Section titled “Request Bodyrequired”CIDR, region, and name are immutable. To change them, delete the VPC and create a replacement.
object
AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no
leading/trailing whitespace) mapped to freeform UTF-8 values
(0-256 bytes). Max 50 tags per resource. Reserved prefixes
(stratum.dev/, stratum.platform_health., stratum:,
aws:) return 400 RESERVED_NAMESPACE on customer input.
PATCH replaces the whole map..
object
Example generated
{ "displayName": "example", "description": "example", "internetGateway": true, "dnsHostnames": true, "dnsResolution": true, "tags": { "additionalProperty": "example" }}Responses
Section titled “Responses”Updated.
object
Set on a platform-owned row; absent on a tenant’s own.
object
The owner: the Auto Scaling group id, or for platform the component (front-door, pack:platform-health, default-network, operator-recipe).
Canonical Stratum ARN for this VPC, for resource-policy targeting.
RFC 1918 CIDR block; /16 to /28; immutable.
Additional IPv4 CIDR blocks associated with the VPC. Subnets may carve from the primary or any
secondary block. Managed via the
/actions/associate-cidr-block +
/actions/disassociate-cidr-block endpoints.
Associated DHCP option set; empty means the
built-in defaults. Managed via
/actions/associate-dhcp-options.
When true, the VPC’s logical router gets an external port + default
0.0.0.0/0 route to the upstream and a transit IP allocated from the
FIP pool. Inbound reachability requires a floating IP attached to a
NIC. Outbound differs from AWS. Stratum at v1 also installs an
implicit-SNAT rule on the LR (source = the VPC CIDR, snat-to = the
transit IP), so every VM in the VPC reaches the internet whether
or not it has a floating IP — AWS would require a NAT Gateway for
that. documents the delta + the 2.0 plan to
restore AWS-strict semantics via the explicit NATGateway
resource. Operators building isolation on “no FIP = no internet”
must keep this flag false.
Per-VPC transit-network IP allocated by the lifecycle worker when the OVN external LRP is wired. Empty means the LRP isn’t wired yet (desired but not yet converged) or the VPC has no IGW.
AWS-shape resource tags. Freeform UTF-8 keys (1-128 bytes, no
leading/trailing whitespace) mapped to freeform UTF-8 values
(0-256 bytes). Max 50 tags per resource. Reserved prefixes
(stratum.dev/, stratum.platform_health., stratum:,
aws:) return 400 RESERVED_NAMESPACE on customer input.
PATCH replaces the whole map..
object
The VPC resolver’s address on each available subnet, ordered by subnet id. Empty when no resolver answers in this VPC: DNS resolution is off, or the install runs no per-VPC resolver.
The VPC resolver’s address on one subnet: the subnet’s .3, which DHCP hands instances as their DNS server and which forwards to the VPC’s recursor.
object
The subnet’s .3.
Example
{ "ownedBy": { "kind": "auto-scaling-group" }, "cidrBlock": "10.0.0.0/16", "state": "creating", "resolverAddresses": [ { "address": "10.0.1.3" } ]}Bad request.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Authenticated but not authorized.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}Resource not found.
object
The findings of a rejected IAM policy document (custom and resource policies).
One finding of a rejected IAM policy document. A rejection lists every finding, so the author fixes the document in one round trip.
object
The finding, e.g. INVALID_DOCUMENT, UNKNOWN_ACTION, ACTION_NOT_APPLICABLE.
Index of the statement at fault; -1 for the document as a whole.
The offending action, where one is at fault (ACTION_NOT_APPLICABLE).
Field errors, for codes that carry them: each problem at its field
(see FieldError). Documented on the responses that set it, e.g.
approveNodeJoin’s INVALID_INPUT and JOIN_APPROVAL_REFUSED.
Absent otherwise.
One field’s problem, the stage-2 installer API’s shape.
field is the field’s path, message what is wrong with it.
object
The field’s path, e.g. links[0].interface, disks[1].confirm,
mgmt.address or role; empty for the whole request.
Structured facts about the refusal, for codes that carry them. The
shape is fixed per code and documented on the response that answers
it, e.g. IMAGE_POOL_MISMATCH (see ImagePoolMismatchDetails) and
IMAGE_IN_USE. Absent for codes that carry none.
object
Example
{ "issues": [ { "code": "ACTION_NOT_APPLICABLE", "action": "compute:CreateVpc" } ]}